How to Manage Passwords at a Business Level

Keeping hundreds or thousands of employee passwords safe is no easy undertaking. The good news is that learning how to manage passwords is surprisingly simple—you don’t have to manage them manually. There are plenty of helpful tools at your disposal, including enterprise password managers: a tried-and-true option that helps businesses keep employee credentials safe and implement password policies.

A password manager can save employee time and your bottom line. Read on to learn how to manage passwords across departments and employees—all of which will require different levels of access to different applications.

How to manage passwords at your business

Say goodbye to memorization, spreadsheets, and sticky notes. Here are four best practices that can help you set up password management for your business the right way.

1. Create policies for business password management

A password manager is only as good as the human-first security culture of the organization that uses it. You’ll need to create policies that support and reinforce the use of the password manager, as well as other cybersecurity best practices. Some popular policies that IT admins enact alongside the implementation of a password manager include:

• Establish criteria for each password. Define how long, complex, and unique each password should be. Or, better yet, recommend that employees use a password generator to create passwords that automatically adhere to these criteria. To learn more about how complex a password must be to be considered secure, read our blog post about how strong to make a password and when to change it.
• Set standards for sharing and revoking passwords among in-person and remote teams. Employees can be tempted to ineffectively manage their passwords. This includes sharing passwords using unsafe methods, such as email and chat applications, or by writing them on sticky notes. Providing the right tools, such as an enterprise password manager with a secure group-sharing feature, and setting standards about how to share passwords can decrease these unsafe practices.
• Determine when passwords should be changed. Small slip-ups can provide a window of opportunity for cybercriminals to access data. Passwords should be changed after infractions of the policies mentioned above, such as sharing passwords across unsafe platforms or after an employee leaves a company. Of course, if a breach does occur, be sure to set a standard that every password should be changed immediately.
• Enforce policies across the entire company. Business password management works best when policies are consistently enforced and embedded into an organization’s culture. Consider encouraging employee participation through incentives, annual training, and requiring signatures on policy documents. Read our blog post to learn more about how to create a password policy your employees will actually follow.

2. Choose a designated contact person

Having one contact person in charge of a company’s password management strategy gives employees a resource to go to with questions about how to manage passwords. Also, this password management champion can play a proactive role in password security.. They can kickstart conversations, communicate policy changes and updates, and create a robust security culture.

While this person is typically an IT admin, it could be anyone. Especially in the cases of small- to medium-sized businesses that may not have a full-time IT admin, the champion can be anyone who has the time or interest.

3. Implement onboarding and annual cybersecurity training

Onboarding and annual cybersecurity training can provide an opportunity to share updates to best practices, refresh employees’ memories about cybersecurity tools and resources, and answer questions about how to manage passwords. These sessions should educate employees on the why and how of password best practices. Plus, they should include how to identify and avoid cyberattacks such as phishing and ransomware.

4. Monitor the company password health

Password managers like Dashlane offer IT admins analytics tools that provide a snapshot of business security practices and weak spots. These reports will be helpful when determining what kind of annual cybersecurity training an organization needs.

How can a business password manager help employees manage passwords?

Enterprise password managers work by encrypting all employee passwords for extra layers of security. Encryption works like a secret code, scrambling employees’ passwords a different combination of letters, numbers, and symbols before they’re stored. This secret code can only be unencrypted by the password manager. Thus, even IT admins are unable to retrieve a password from the database. Many password managers for businesses, like Dashlane, are built with this “zero-knowledge architecture” to ensure employee passwords stay safe.

In addition, the right business password manager will balance security with ease of use, because a password manager is only effective if employees use it. Dashlane’s password manager has multiple layers of encryption and has never been hacked, but Dashlane also prioritizes an intuitive user experience. With the ability to organize separate business and personal passwords under the same account, employees love using Dashlane both in and out of the office.

Password managers can go above and beyond secure password storage to:

1. Track the collective password health of a company
2. Monitor the Dark Web (where most passwords are sold) for stolen employee passwords
3. Integrate with other security strategies like single-sign-on technology and 2-factor authentication for added security

Dashlane rolls all these features into one powerful tool, helping IT admins effectively implement and monitor best practices across the organization.

“I like that Dark Web Monitoring lets me know if any of my information has ever been compromised.”

— Elspeth Moffatt,
Elspeth Moffatt, Director of Communications, CSG

4 reasons to use a password manager for your business

1. Helps IT implement security best practices and monitor performance

By offering password health analytics tools and reporting on top of secure password storage, password managers help IT admins track progress toward cybersecurity goals.

2. Improves employee productivity

By automating the login process, password managers can reduce time spent creating and protecting passwords or calling the help desk for password resets. Plus, since password managers also offer a simple format for collaborating and sharing passwords with team members, productivity increases.

3. Prevents unsafe password habits

Because password managers automatically populate a user’s credentials, employees are incentivized to create complex passwords they don’t have to remember. Password managers help employees manage their passwords and avoid creating common passwords, reusing passwords, or writing them down. Given that the most common passwords are some of the easiest to remember, a complex and unique password will help accounts stay secure.

4. Protects your company’s reputation and strengthens the bottom line by preventing breaches

Within six months of a cyberattack, an estimated 60% of small- to medium-sized companies go out of business. With 61% of data breaches involving compromised credentials, password managers can play a major role in avoiding a data breach. And consumers pay attention to cybersecurity; 83% of consumers prefer to do business with companies that prioritize data protection.

Choosing the right software for managing passwords

Company password managers come with many tools and resources IT admins can use to implement a robust password management system. Be sure to select a password manager that balances ease of adoption with strong, real-world security features. As you address how to manage passwords and research different solutions, below are some features your password manager should have:

• Integration with existing platforms, such as your company’s SSO provider
• Automatic deployment across employees’ devices (without assistance from IT)
• Educational training and a minimum of 24/5 support for IT admins and employees
• Smooth onboarding and offboarding processes for employees
• Secure password sharing so employees don’t need to share passwords through unsecure means like Slack, Microsoft Teams, or Google Chat
• A strong security history and zero-knowledge architecture
• Notifications to IT admins of breached accounts, activity logs, and actionable password health insights
• Additional features like a VPN or coverage that goes beyond the office